CalPrivacy alleged that Tractor Supply’s privacy notices fell short, that job applicants were not told their privacy rights, that it had no working opt-out including for Global Privacy Control, and that it shared data with third parties without the required contracts. Tractor Supply was ordered to pay $1.35 million and change its practices. That includes scanning its digital properties to list the tracking technologies on them and having an officer sign off on its practices every year for four years.
On 30 September 2025, the California Privacy Protection Agency, now known as CalPrivacy, announced that its Board had issued a decision against Tractor Supply Company, which it called the nation's largest rural lifestyle retailer, with more than 2,500 stores in 49 states. The investigation began with a complaint from a consumer in Placerville, California.
According to the Board's decision, Tractor Supply did not give consumers an effective way to opt out of the sale and sharing of their personal information, including through opt-out preference signals such as Global Privacy Control. The agency also alleged that its privacy policy did not tell consumers their rights, that California job applicants were not told their privacy rights or how to use them, and that it disclosed personal information to other companies without contracts containing privacy protections.
To resolve the allegations, Tractor Supply agreed to pay $1,350,000, which the agency described as the largest amount in its history at the time. It also agreed to broad changes: scanning its digital properties to inventory the tracking technologies on them, and having a corporate officer or director sign off on its practices every year for four years. The agency said the decision was its first to address privacy notices and the privacy rights of job applicants.
None of this involved a hacker or a leaked database. It came down to ordinary tags on retail websites, and an opt-out that, by the agency's account, did not work. Michael Macko, the agency's head of enforcement, said it would continue to look broadly across industries.
Tractor Supply is not the only case on this theme. In March 2025, the same agency ordered American Honda Motor Co. to pay $632,500. It alleged that Honda asked for too much personal information before letting people use their privacy rights, and shared data with ad tech firms without the required contracts.
For any website, the questions are the same. Is there a current list of every tracker on the site? Which tags fire before a visitor makes a choice? Do they stop when a visitor opts out, or when the browser sends a Global Privacy Control signal? And do the contracts with the companies receiving the data carry the privacy terms regulators look for?